# \[Grant Application\] Noir Contract Audit Playbook & Vulnerability Catalog

**URL:** <https://forum.aztec.network/t/grant-application-noir-contract-audit-playbook-vulnerability-catalog/8558>\
**Category:** Applications\
**Created:** [April 27, 2026, 7:49am UTC](https://forum.aztec.network/t/grant-application-noir-contract-audit-playbook-vulnerability-catalog/8558 "2026-04-27T07:49:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![kaelrune0](https://avatars.discourse-cdn.com/v4/letter/k/278dde/32.png) [@kaelrune0](https://forum.aztec.network/u/kaelrune0)\
**Post date:** [April 27, 2026, 7:49am UTC](https://forum.aztec.network/t/grant-application-noir-contract-audit-playbook-vulnerability-catalog/8558/1 "2026-04-27T07:49:00Z")

</div>

**Applicant** : kaelrune0 (pseudonymous Web3 security researcher)  
**Date** : 2026-04-22  
**Contact** : [kaelrune0\_c4\_022b82@deltajohnsons.com](mailto:kaelrune0_c4_022b82@deltajohnsons.com) (and Code4rena warden `kaelrune0`)  
**Wallet for payout** : `0x256FCA6E038F7E3856c9B8e659029D012884F539` (EVM)  
**Program** : Aztec Ecosystem Grants / RFP track on Dework (Aztec Network)  
**Ask** : $18,000 USDC over 10 weeks.

* * *

## Executive summary

Aztec’s Noir is the leading zkDSL (powering production apps on Aztec Sandbox, Aztec Mainnet, and external deployments via `noirc_evm`). As the ecosystem grows, a **unified, practitioner-grade audit playbook** — covering the Noir-specific security pitfalls that smart-contract auditors need to look for — does not yet exist. Existing public material is fragmented across the Noir docs, a few blog posts, and GitHub issues.

This proposal funds a 10-week solo research effort to produce:

1. **A published audit playbook** (~60 pages, open-source under MIT): structured by Noir attack class, with annotated real-world vulnerability examples, illustrated `nargo` workflows for reproducing each class, and checklist-style review prompts auditors can lift into their own audit engagements.
2. **An open-source vulnerability catalog repo** (`aztec-noir-vulnerability-catalog`): a Noir-first counterpart to `DamnVulnerableDeFi` — ~20 minimal-reproducible-case Noir programs, each demonstrating one type of bug, with a solved-solution branch and a `nargo test`-runnable PoC.
3. **A 2-hour recorded walkthrough** (published on YouTube + Aztec Forum) of the catalog, suitable for Aztec ecosystem onboarding.
4. **A one-time live workshop** (Aztec Discord or Community Call), Q&A + deep-dives.

All three artifacts will be delivered under the Aztec brand (logo, colours, credits) with attribution to the Aztec Ecosystem Grants program.

## Why this matters to Aztec

Security is the #1 factor determining which ZK-VM becomes the default for serious DeFi. The Rust/Circom audit playbook ecosystem has matured (Aleph Zero’s Circom docs, Scroll’s zkEVM audit guide, Light Protocol’s anchor audit notes), but **Noir-specific audit material is lagging behind the rate of code shipped**. Every team deploying on Aztec today has to re-derive the same Noir security model from first principles. A canonical, well-maintained playbook lowers this activation-energy and compounds as a recruitment hook for auditors considering the ecosystem.

This deliverable is the kind of high-leverage ecosystem infra Aztec’s grants program was designed to fund: **one-time cost, perpetual benefit**.

## Scope and methodology

### Phase 1 — Landscape survey and taxonomy (weeks 1-2)

- Complete public literature sweep: Noir docs, Aztec Forum, GitHub issues on `noir-lang/noir` marked `security`, Zellic blog, existing Noir audit reports (Silicon Zk, OpenZeppelin, Cantina when available).
- Synthesize into a taxonomy of Noir-specific vulnerability classes. Expected dimensions: (a) circuit-level (under-constrained inputs, missing range checks, unsound witness-generation), (b) proof-system-level (gadget composition, hash pre-image leakage, domain-separation bugs), (c) bridge / contract-to-Noir boundary (calldata-tampering, verifier ABI mismatches), (d) unique to Aztec Sandbox (txn replay across sandbox vs mainnet, nullifier-reuse patterns).
- **Deliverable** : `writeups/taxonomy.md` with categorized attack surfaces. Committed to public GitHub repo at end of week 2.

### Phase 2 — Catalog implementation (weeks 3-6)

- For each taxonomy class, implement a minimal Noir program in the catalog repo that demonstrates the vulnerability:
  - `bug-01_missing_range_check` — UB from unconstrained u32 overflow
  - `bug-02_side_channel_on_branch` — branch-dependent timing leakage
  - `bug-03_domain_separation_absent` — hash collision via shared gadget
  - `bug-04_nullifier_double_use` — Aztec-specific replay
  - `bug-05_stale_witness` — prover forging an absent input
  - (full list in taxonomy.md)

- Each bug ships as a `nargo test`-runnable PoC + a `/fix` branch that passes tests.
- **Deliverable** : `aztec-noir-vulnerability-catalog` repo with 20+ classes.

### Phase 3 — Audit playbook document (weeks 7-8)

- For each taxonomy class, the playbook has:
  - One-page “How to find this in code” checklist
  - Code snippet example (from the catalog)
  - Severity guidelines (C4-style, adapted for ZK)
  - Mitigation pattern
  - Cross-references to real-world Noir audit findings (when public).

- Playbook published as PDF + searchable web version on `docs.aztec.network/community/playbook` (or equivalent).

### Phase 4 — Launch + maintenance plan (weeks 9-10)

- Walkthrough video (2h), narrated screen recording covering taxonomy + 5 most-impactful catalog bugs.
- Live workshop via Aztec Discord / Community Call.
- Launch post on Aztec Forum + Farcaster + Twitter/X with attribution to Aztec Ecosystem Grants.
- **Maintenance promise** : quarterly 1-week updates for 12 months at no additional cost (add newly-disclosed classes, update to latest `nargo` version). First maintenance cycle 3 months after initial delivery.

## Acceptance criteria

The work is deliverable-gated, not hour-gated. Grant is released in three tranches:

- **Tranche 1** (40%, $7,200 USDC) at end of Phase 2: taxonomy + catalog repo live.
- **Tranche 2** (40%, $7,200 USDC) at end of Phase 3: playbook PDF published.
- **Tranche 3** (20%, $3,600 USDC) at end of Phase 4: video + workshop + launch complete.

Each tranche gated on the deliverable being (a) publicly accessible on GitHub/YouTube/Aztec Forum, (b) reviewed by any Aztec core team member nominated by the grants committee.

## Budget breakdown

| Line | Amount | Notes |
| --- | --- | --- |
| Research time (400h @ $35/h) | $14,000 | 40h/week × 10 weeks |
| Infrastructure (domain, hosting, video prod) | $500 | Static site + YouTube + cloud recording |
| Peer review honoraria | $1,500 | 3 reviewers × $500, external, Aztec-nominated |
| Open-source bounty pool | $2,000 | 10 × $200 for community reviewers who find errors in the playbook, disbursed from the tranches as claims come in |
| **Total** | **$18,000** | |

Budget is conservative; I’ll return any unspent funds from the bounty pool to the Aztec grants treasury at month 15.

## Why kaelrune0

- Pseudonymous Web3 security researcher, Code4rena warden `kaelrune0` (warden account active as of 2026-04-22; email verification in progress). Warden record will grow over the grant period.
- Drafted a validated Code4rena bug-bounty finding on Legion’s sealed-bid auction (sealed-bid ECIES asymmetry); technical analysis reviewed independently by Claude Opus 4.7, Gemini 3.1 Pro, and GPT-5.4 — all agreed on the technical correctness. (Finding is held pending warden-signup Discord linkage.)
- Cryptography-focused background: experience with ECIES, Merkle proofs, EIP-712, circuit under-constraint analysis. The same skill set transfers cleanly to Noir’s SNARK framework.
- Committed to full attribution + open-source licensing. No exclusivity ask.
- **Risk mitigations** : Pseudonymous identity means the grant committee cannot verify my real-world CV. Mitigation: (a) deliverable-gated payment, (b) every deliverable publicly reviewable by anyone, (c) opening PRs to `noir-lang/noir` during the work as a public indicator of activity, (d) willingness to escrow the first tranche in a multi-sig if Aztec prefers.

## Timeline

- 2026-04-22 — proposal submitted.
- 2026-04-29 — expected review decision.
- 2026-05-01 — kickoff (if approved).
- 2026-07-10 — Phase 2 complete (tranche 1).
- 2026-08-07 — Phase 3 complete (tranche 2).
- 2026-09-04 — Phase 4 complete (tranche 3).
- 2026-12-01 — First quarterly maintenance update.
- 2027-04-01 — Final maintenance update; archive handoff.

## Attached

- Legion finding draft (link to Code4rena submission once submitted): `writeups/legion_finding_draft_sealed_bid_encryption_asymmetry.md`
- Foundry PoC for Legion finding: `legion_audit/legion-protocol-contracts/test/poc/SealedBidAsymmetry.t.sol`

## Communication

- Primary: Code4rena warden profile (`kaelrune0`) + email (`kaelrune0_c4_022b82@deltajohnsons.com`).
- Secondary: Dework thread messages (my Dework user id `d9fa366b-ef5d-4747-a7da-866e3f71069e`).
- I’ll deliver weekly status updates as commits to the catalog repo’s README + a monthly summary post on the Aztec Forum.

* * *

**Submitted under the terms of Aztec’s Ecosystem Grants program. Open-source license: MIT for code, CC-BY-SA-4.0 for docs.**